3 ms·

Is NextDNS Privacy Safe? They say that "we do not (and will never) sell As with any service I suppose it depends on how much one trusts them without having a

Is NextDNS Privacy Safe? They say that "we do not (and will never) sell As with any service I suppose it depends on how much one trusts them without having a mutually agreed to, signed and notarized contract that has severe penalties for breach. I do not know much about NextDNS so my question would be, how does anyone know for sure how long they retain query logs if at all and are any of their employees here on HN that could answer this? If one could not answer this then perhaps a mitigating control may be to terminate DNS via DoH/DoT to a self hosted VM somewhere then use something like Unbound DNS to forward via DoT/DoH upstream to NextDNS so that they only have a random VM IP in their logs. One could also pre-cache the most common domains and many random domains hourly in a cron job to hide ones behavior. This method may allow for quickly switching to another provider in a centralized location without having to reconfigure all the individual devices.

giuliomagnifico 4y ago
Thank for the reply, using a VM as a DNS server it’s a nice idea but I have to pay another VM, I prefer to use my VPN and my Unbound server at home. Trouble with WireGuard is not the DNS lag, those are all cached, but the normal latency increases about the double. But I should explore the option to buy the DigitalOcean base base plan. At least to try to check the latency.
- LinuxBender 4y ago
  There is extra latency in this setup but some of it can be mitigated by using a cron job to pre-lookup / pre-cache the most common DNS names that your setup requests. Unbound can also be told to set a min-ttl on all records at the risk of answer becoming stale but I find that to rarely be an issue. There are a handful of less expensive VM providers. Ramnode is one of them. I hear they have been improving in the last few years but I no longer have any VM's so I can't say for sure.
  - giuliomagnifico 4y ago
    Well with unbound there’s almost no latency because it pre-downloads all the roots names. No need for cron job because it auto updates the root.hints file (usually once every 1/2 months) But I mean the latency to route all the DNS queries to my cheap VM instead of using the default ones. Thanks for the info of Ramnode!

giuliomagnifico 4y ago

Thank for the reply, using a VM as a DNS server it’s a nice idea but I have to pay another VM, I prefer to use my VPN and my Unbound server at home. Trouble with WireGuard is not the DNS lag, those are all cached, but the normal latency increases about the double. But I should explore the option to buy the DigitalOcean base base plan. At least to try to check the latency.

LinuxBender 4y ago
There is extra latency in this setup but some of it can be mitigated by using a cron job to pre-lookup / pre-cache the most common DNS names that your setup requests. Unbound can also be told to set a min-ttl on all records at the risk of answer becoming stale but I find that to rarely be an issue. There are a handful of less expensive VM providers. Ramnode is one of them. I hear they have been improving in the last few years but I no longer have any VM's so I can't say for sure.
- giuliomagnifico 4y ago
  Well with unbound there’s almost no latency because it pre-downloads all the roots names. No need for cron job because it auto updates the root.hints file (usually once every 1/2 months) But I mean the latency to route all the DNS queries to my cheap VM instead of using the default ones. Thanks for the info of Ramnode!